topic Re: Forwarding logs from AIX to Splunk on Windows? in Getting Data In

Forwarding logs from AIX to Splunk on Windows?

ajayk — Wed, 08 Jun 2011 19:55:59 GMT

We have installed Splunk on Windows . We would like to forward log messages from AIX box to Splunk on Windows. However the forwarding is not working.

Looking at this - http://www.splunk.com/base/Documentation/latest/Deploy/Enableareceiver
I think, we have to install an app for AIX. Where can I find one ?

Re: Forwarding logs from AIX to Splunk on Windows?

mw — Wed, 08 Jun 2011 20:51:36 GMT

You can either configure your Splunk instance to listen on udp:514 for syslog traffic, and configure the AIX systems to send syslog events to it via their built-in syslog service, or you can configure Splunk to receive forwarded data and install a forwarder on each AIX system ( http://www.splunk.com/download/universalforwarder ) which you'll then instruct to monitor all files in /var/log, as well as configuring it to forward data via outputs.conf

For the first scenario, you'll need this:

Receive syslog: http://www.splunk.com/base/Documentation/latest/Data/Monitornetworkports

For the second scenario, you'll need these:

Universal Forwarder download: http://www.splunk.com/download/universalforwarder

Monitor files: http://www.splunk.com/base/Documentation/latest/Data/Monitorfilesanddirectories

Forwarding and Receiving: http://www.splunk.com/base/Documentation/4.2.1/Deploy/Setupforwardingandreceiving

Re: Forwarding logs from AIX to Splunk on Windows?

ajayk — Wed, 08 Jun 2011 21:33:56 GMT

We are using second scarnario. We are testing with application logs .. to start with.

Universalforwarder has been installed on AIX boxes. On windows 2003 Server 32 bit, We have Splunk listening on port 9997. However, the Universalforwarder is not able to forward the logs.

Re: Forwarding logs from AIX to Splunk on Windows?

mw — Wed, 08 Jun 2011 22:23:12 GMT

You need to configure some inputs:

# inputs.conf
[monitor:///var/log]
disabled=0
sourcetype=syslog

You need to configure the Universal forwarder to send events to the Splunk server:

# outputs.conf
[tcpout]
defaultGroup = group1
indexAndForward = false

[tcpout:group1]
server = splunk_server:9997
useACK = true